Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
3
votes
1answer
232 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
2
votes
1answer
195 views

Forcefully interpret code in x64dbg

I was just wondering if there was a way to force an interpretation of a block of code in x64dbg. The section im analyzing fluctuates between this: and this:
5
votes
2answers
12k views

How to view string references?

I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it ...
4
votes
1answer
4k views

How to copy binary file with x64dbg\x32dbg after it changed it self

I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it. I have a packed binary file and at some point it unpacks itself and I found the point where it does it. I want to ...
0
votes
1answer
6k views

How can i add plugins in x64dbg?

I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger. Its installation instructions are not working.
1
vote
0answers
235 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
3answers
917 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
1
vote
1answer
501 views

identifying function prototype from dll

I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution. So my requirement is to create a program ...
0
votes
1answer
1k views

x64Dbg view jumps to selected command

I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's "show jumps to selected command": Thanks all
6
votes
1answer
4k views

Trace back which function called the message box in x64dbg?

I have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why. I found the referenced string but ...
-1
votes
1answer
1k views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
0
votes
1answer
497 views

Is there a way to see all “values” in memory?

In a program I'm working on, a variable is set using a memory address: mov r9, [0x0000000000472C10] Is this the equivalent? (forgive the python code): value = 55 <---- value at memory address ...
0
votes
1answer
1k views

Run program until completion without debugging step by step [closed]

I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
1
vote
1answer
1k views

Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?

Some of my breakpoints perfectly survive multiple restarts. But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
1
vote
1answer
2k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
-2
votes
1answer
196 views

What are modern techniques of reverse engineering? [closed]

I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
5
votes
1answer
886 views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
2
votes
2answers
1k views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
1
vote
1answer
2k views

How can I define a struct in x64/x32Dbg?

See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
3
votes
1answer
3k views

Dealing with exceptions in x64dbg

I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION) The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
3
votes
0answers
180 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
2
votes
0answers
243 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
5
votes
1answer
336 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
2
votes
1answer
278 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
5
votes
2answers
2k views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
2
votes
1answer
105 views

In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?

I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A. What steps should I take in order to find out which function this is and/or what it does? The ...
3
votes
0answers
222 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
4
votes
2answers
5k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
1
vote
1answer
2k views

Find what writes to a dynamic memory address

I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
0
votes
1answer
1k views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
0answers
687 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
4
votes
1answer
2k views

IDA Pro Plugin to add x64dbg

Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
3
votes
1answer
2k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)

1 2
3